What happened to Unitel?
Angola’s largest telecom operator, Unitel, was hit by a cyberattack in the early hours of Tuesday morning. The incident knocked out voice services, mobile data, and internet access for millions of customers across the country.
The company detected the breach shortly after 2 a.m. local time. In a statement, Unitel said response and containment mechanisms were immediately activated, and technical and cybersecurity teams were mobilized. Yet services remained disrupted as of Wednesday, with no clear timeline for full restoration.
What makes this attack particularly striking is the timing. It struck less than 24 hours before Unitel was due to make its stock market debut on Angola’s exchange, BODIVA.
Network data reveals the likely cause
Network measurement data from RIPE NCC, reviewed by Recorded Future News, shows that Unitel’s IP prefixes remained announced to the global internet throughout the incident. That means the routers connecting the company to the rest of the internet stayed online.
Those prefixes would normally disappear if the disruption came from an external source, such as an upstream connectivity cut or a volumetric DDoS attack. Their persistence suggests the cause was instead an incident that disabled core internal systems.
Traffic telemetry from Cloudflare Radar shows Unitel’s traffic collapsing sharply from around the time of detection and remaining well below baseline into Wednesday. The disruption appears specific to Unitel — no other Angolan network operator showed any degradation over the same period.
Impact on businesses and payments
The outage also disrupted point-of-sale payment terminals running on Unitel’s network, according to Angolan business publication Expansão. That means businesses across the country struggled to process card payments, and digital services dependent on internet access were hobbled.
The IPO went ahead anyway
Despite the ongoing outage, Unitel began trading Wednesday on the Angolan securities exchange, known as BODIVA. It became the largest initial public offering in Angola’s capital market history.
The Angolan state, through its asset management institute IGAPE, sold a 15% stake in the company. The offer, which ran from July 6 to July 24, was oversubscribed at a rate of 120.72%, with more than 11,000 investors participating.
Trading proceeded Wednesday, valuing the company at $2.14 billion and raising around $321 million for the government. Neither BODIVA nor Angola’s capital markets regulator had issued any public statement about the cyberattack as of the time of publication.
A test for Angola’s privatization push
The listing is a centerpiece of President João Lourenço’s privatization program, which aims to reduce state dominance in the former Marxist-Leninist economy and attract foreign capital. Unitel became the first non-financial company listed on the Angolan exchange.
Its successful subscription was widely seen as a test of investor appetite for Angolan state assets — and a potential precursor to the listing of larger entities, including national oil company Sonangol.
Unitel came under state control in 2022 after authorities seized shareholdings previously owned by Isabel dos Santos, daughter of former President José Eduardo dos Santos. That move was part of Lourenço’s broader effort to unwind business networks tied to his predecessor’s 38-year administration.
What’s next?
Angolan authorities have not made any statements regarding the timing of the attack or whether it was linked to the IPO. Unitel has not commented on the nature of the breach — whether it was ransomware, a destructive wiper, or something else entirely.
For now, millions of Angolans remain without reliable mobile service, and businesses are feeling the pinch. The fact that the attack hit exactly when it did — hours before a landmark listing — raises questions that authorities will need to answer.
This isn’t the first time a major telecom has faced such a crisis. Telecom cyberattacks have become increasingly common in emerging markets, where state-owned operators often run aging infrastructure with limited security budgets. Angola’s next steps will be watched closely by investors and regulators alike.
